versionscan

versionscan Versionscan is a tool for evaluating your currently installed PHP version and checking it against known CVEs and the versions they were fixed in to report back potential issues. PLEASE NOTE: Work is still in progress to adapt the tool to linux distributions that backport security fixe...

phpstan

PHPStan - PHP Static Analysis Tool PHPStan focuses on finding errors in your code without actually running it. It catches whole classes of bugs even before you write tests for the code. It moves PHP closer to compiled languages in the sense that the correctness of each line of the code can be...

Visual Composer <= 45.16.0 - Unauthenticated LFI

Visual Composer Website Builder for WordPress = 45.16.0 contains a local file inclusion vulnerability caused by improper validation of the vcv-template parameter, letting unauthenticated attackers include and execute arbitrary files, exploit requires no authentication. id: CVE-2026-12227 info:...

tagDiv Composer < 4.2 - Stored Cross-Site Scripting

tagDiv Composer plugin versions before 4.2 for WordPress are vulnerable to unauthenticated stored XSS via the /wp-json/tdw/savecss endpoint. An attacker can inject malicious JavaScript code through the compiledcss parameter, which gets stored and executed when the CSS is loaded. id: CVE-2023-3169...

Nette Framework - Remote Code Execution

Nette Framework versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, and 3.0.6 are vulnerable to a code injection attack via specially formed parameters being passed to a URL. Nette is a PHP/Composer MVC Framework. id: CVE-2020-15227 info: name: Nette Framework - Remote Code Execution author:...

WordPress tagDiv Composer < 3.5 - Authentication Bypass

The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address id:...

magescan

Mage Scan The idea behind this is to evaluate the quality and security of a Magento site you don't have access to. The scenario when you're interviewing a potential developer or vetting a new client and want to have an idea of what you're getting into. Installation .phar Download the magescan.pha...

CVE-2021-38163

CVE-2021-38163 - SAP NetWeaver AS Java Desynchronization-Schwachstelle Beschreibung CVE-2021-38163 ist eine Sicherheitslücke im SAP NetWeaver Application Server AS Java , die es einem authentifizierten Angreifer ermöglicht, beliebige Dateien auf den Server hochzuladen, was potenziell zu Remote Co...

CVE-2025-31324

CVE-2025-31324 Proof-of-Concept 0day für SAP NetWeaver erstellt von ShinyHunters CVE-2025-31324 ist eine kritische Sicherheitslücke vom Typ "Unrestricted File Upload", die den SAP NetWeaver Application Server AS Java betrifft. Genauer gesagt befindet sie sich in der Visual Composer-Komponente...

SAP-CVE-2025-31324

SAP-CVE-2025-31324 POC Ein Tool zur Erkennung und Ausnutzung einer kritischen, nicht authentifizierten Datei-Upload-Schwachstelle in SAP NetWeaver Visual Composer. Beschreibung SAP NetWeaver Visual Composer enthält eine Komponente namens Metadata Uploader, der die ordnungsgemäßen...

CVE-2025-31324_PoC_SAP

CVE-2025-31324PoC Proof-of-Concept für CVE-2025-31324: Unauthentifizierter Upload im SAP NetWeaver Visual Composer Metadata Uploader Dieses Skript führt Folgendes aus: 1. Datei-Upload an den verwundbaren Endpunkt über Upload-Host/Port 2. Optionaler Trigger via HTTP GET über Trigger-Host/Port 3...

CVE-2026-12227

CVE-2026-12227: Visual Composer Website Builder Inclusão Local de Arquivo LFI Não Autenticada Resumo CVE-2026-12227 é uma vulnerabilidade crítica CVSS 9.8 de Inclusão Local de Arquivo LFI não autenticada no plugin Visual Composer Website Builder para WordPress, afetando todas as versões até e...

CVE-2021-38163

CVE-2021-38163 CVE-2021-38163 - Exploit für SAP Netveawer SAP NetWeaver Visual Composer 7.0 RT Versionen – 7.30, 7.31, 7.40, 7.50 – ohne Einschränkung: Ein Angreifer, der als nicht-administrativer Benutzer authentifiziert ist, kann eine schädliche Datei über ein Netzwerk hochladen und deren...

CVE-2026-12227

CVE-2026-12227: Visual Composer Website Builder Inclusão Local de Arquivo Não Autenticada LFI Resumo CVE-2026-12227 é uma vulnerabilidade crítica CVSS 9.8 de Inclusão Local de Arquivo LFI não autenticada no plugin Visual Composer Website Builder para WordPress, afetando todas as versões até e...

CVE-2026-40176

CVE-2026-40176 — Composer Perforce-Treiber-Befehlsinjektion Proof of Concept Ein eigenständiger, OOP-orientierter PHP-Proof-of-Concept, der eine Befehlsinjektions-Schwachstelle im Perforce-Repository-Treiber von Composer demonstriert und differential verifiziert. Der PoC führt dieselbe bösartige...

CVE-2025-31324

SAP CVE-2025-31324 Analysator Ein Python-basierter Sicherheitsscanner zur Identifizierung der CVE-2025-31324 -Sicherheitslücke in SAP Visual Composer-Systemen und zur Erkennung bekannter Kompromittierungsindikatoren IOCs wie schädlicher .jsp-Dateien. 🚀 Funktionen Erkennt anfällige Visual...

CVE-2021-43503

Warnung Die Schwachstelle wurde zurückgezogen Überschreiben Dieser Beitrag behandelt CVE-2021-43503. Ich kann diese Schwachstelle mit dem exp nicht reproduzieren. Voraussetzungen PHP 7.1. Composer registrar=$b; namespace Illuminate\Queue\Capsule class Manager protected $manager; public function...

CVE-2026-12227-visualcomposer-lfi-poc

CVE-2026-12227 - Laboratório de Validação de LFI Não Autenticado no Visual Composer via vcv-template Material de pesquisa de segurança para reproduzir e validar o CVE-2026-12227 : uma inclusão local de ficheiro não autenticada na resolução de templates de página do Visual Composer Website Builder...

CVE-2026-84361-poc

CVE-2026-84361: PoC de Execução de Comando no P4PORT do Composer Perforce English version Execução com Docker Com o Docker Compose, você pode validar em um ambiente isolado que inclui o Composer 2.10.2 afetado e o cliente Perforce p4. O contêiner de execução tem rede desabilitada, sistema de...

composer-CVE-2026-40261-CVE-2026-40176-PoC

!CAUTION ESTE REPOSITÓRIO CONTÉM CÓDIGO DE PROVA DE CONCEITO PARA AS VULNERABILIDADES CVE-2026-40261 E CVE-2026-40176 NO COMPOSER. !CAUTION O CÓDIGO DESTINA-SE APENAS A FINS EDUCACIONAIS E DE TESTE. !CAUTION NÃO USE ESTE CÓDIGO EM AMBIENTES DE PRODUÇÃO NEM CONTRA SISTEMAS SEM A DEVIDA AUTORIZAÇÃO...